Railway Review 2026: $5 Hobby Plan, Per-Second Pricing, Plan Limits and the October Security Breach

Quick verdict

Railway is still one of the fastest ways to get an app and a database online, and its pricing is easy to reason about: $5 a month on Hobby or $20 a month on Pro, each including that much usage, then you pay for what you consume. Builds are free and idle services can sleep, so a small project often costs exactly the plan fee.

The weak side is the operations record. 2026 brought an abuse-system misfire in February, an eight-hour platform-wide outage in May when Google Cloud suspended Railway's production account, two shorter routing incidents, and the October secrets breach. Uptime figures are availability targets rather than an SLA with service credits, and Pro support runs through a forum with a typical 72-hour response.

How Railway works

Every project is a canvas of services. You can deploy from a GitHub repo, a Docker image or a local directory with the Railway CLI, bring your own Dockerfile, and keep settings in config-as-code files (TOML or JSON). PostgreSQL, MySQL, Redis and MongoDB are first-class, each with a high-availability option and point-in-time recovery, and any other open-source database can be deployed from a template. Private networking, TCP and HTTP proxies, preview environments, vertical autoscaling and horizontal scaling through replicas are part of the platform.

Railway now runs on hardware it owns and operates, branded Railway Metal, in four regions: US West (California), US East (Virginia), EU West (Amsterdam) and Southeast Asia (Singapore). Moving a service to another region causes no downtime unless it has a volume attached.

The Serverless setting (formerly App Sleeping) puts a service to sleep somewhere between 5 and 10 minutes after its last outbound traffic, so idle services stop accruing compute charges. Services with static outbound IPs may stay awake.

Railway pricing plans

• Free - $0. Starts as a 30-day trial with a one-time $5 grant, then drops to $1 of credit per month that does not roll over. Up to 1 vCPU and 0.5 GB RAM per service, 0.5 GB of volume storage, community support. No credit card required.
• Hobby - $5 per month, including $5 of usage. Up to 48 vCPU and 48 GB RAM per service, up to 5 GB storage, a single-developer workspace, community support, 7-day log history and a 99.9% availability target.
• Pro - $20 per month, including $20 of usage. Up to 1,000 vCPU and 1 TB RAM per service, up to 42 replicas at 24 vCPU and 24 GB each, up to 1 TB storage, unlimited workspace seats, Railway support, 30-day log history and a 99.99% availability target.
• Enterprise - custom. A committed monthly spend unlocks features: HIPAA BAAs at $1,000, log history, RBAC, SSO and audit logs at $2,000, enterprise support and higher resource limits at $5,000, and dedicated VMs at $10,000. Adds bring-your-own-cloud, up to 2,400 vCPU and 2.4 TB RAM per service, and a 99.999% availability target.

The plan fee is a minimum, not an add-on. Your bill for the cycle is whichever is higher, the fee or your usage. Railway's own example: $7 of usage on Hobby produces a $7 bill, the $5 fee plus $2 of extra usage. Included usage resets every cycle and never accumulates, and the fee is charged even if you use none of it.

Subscriptions and usage are paid by credit card on a post-paid basis; invoice payment is only available on Enterprise, and prepaid credits are no longer offered.

Compute, storage and egress rates

• Memory: $10 per GB per month ($0.000231 per GB per minute).
• CPU: $20 per vCPU per month ($0.000463 per vCPU per minute).
• Network egress: $0.05 per GB.
• Volume storage: $0.15 per GB per month.
• Buckets (object storage): $0.015 per GB-month with unlimited free S3 API operations and free egress. Usage rounds up to whole GB, and buckets are not on the private network.
• VMs and sandboxes: $50 per GB of RAM and $50 per vCPU per month, plus $0.05 per GB egress.
• Builds: free. Railway does not charge for build CPU, memory, base-image downloads, image exports or image storage.

What a typical bill looks like

These are our estimates from Railway's published rates, assuming a service averages the stated load over a full month. Railway meters actual consumption per second, so a spiky app costs less than its peak suggests.

• A small bot averaging 0.1 vCPU and 0.25 GB RAM uses about $4.50, inside Hobby's included $5, so the bill is a flat $5.
• A small API averaging 0.25 vCPU and 0.5 GB RAM uses about $10, so the Hobby bill is $10.
• An app at 0.5 vCPU and 1 GB plus Postgres at 0.25 vCPU and 0.5 GB, a 10 GB volume and 20 GB of egress comes to about $32.50 on either Hobby or Pro, since it clears Pro's $20 minimum too.
• One always-on service averaging 1 vCPU and 1 GB costs about $30 a month.

CPU is the expensive dimension: a full vCPU averaged all month costs twice as much as a GB of memory. Letting idle services sleep is the biggest lever for a smaller bill.

Plan limits that matter

Figures below are Free / Hobby / Pro / Enterprise, from Railway's pricing page and plan docs. Where the trial differs from Free, the trial value is in brackets.

• Projects: 1 (5) / 50 / 100 / unlimited.
• Services per project: 3 (5) / 50 / 100 / unlimited.
• Volumes per project: 1 (3) / 10 / 20, can be raised / unlimited.
• Volume size per service: 0.5 GB / 5 GB / 1 TB self-serve / 5 TB.
• Replicas per service: 1 / up to 6 / 42 / 50.
• Project members: 1 / 3 / unlimited / unlimited.
• Concurrent builds: 1 (3) / 3 / 10 / 10+.
• Build timeout: 10 minutes (20) / 40 minutes / 90 minutes / 90+ minutes.
• Custom domains: 0 (1) / 2 / 20 / unlimited.
• Log retention: 3 days (7) / 7 days / 30 days / 90 days.
• Rollback image retention: 24 hours / 72 hours / 120 hours / 360 hours.
• Audit logs: 48 hours / 48 hours / 30 days / 18 months.

Every plan shares the same network ceiling: 10,000 concurrent connections, around 11,000 requests per second, HTTP requests that may run up to 15 minutes while data keeps flowing but close after 5 idle minutes, and a 32 KB cap on combined headers.

The Free plan is a demo tier, not a hosting plan: one project, three services, no custom domain, no cron jobs, and no global regions or wildcard domains after the trial ends. Accounts that are not verified land on a Limited Trial with restricted outbound network access and a limited set of ports; verification runs through GitHub, and Railway says it does not respond to verification requests.

Static outbound IPs are a Pro feature, and Railway warns the assigned IPv4 addresses may be shared with other customers. For a quick test without signing up at all, running ssh railway.new gives a free Linux VM with 2 vCPU and 2 GB RAM, a 24-hour window to claim it, and a cap of 3 per IP per day.

Billing fine print

• Usage limits: email alerts fire at 75%, 90% and 100% of a custom threshold, and a hard limit, minimum $10, shuts your workloads down once usage passes it. AI agent usage carries a separate hard limit of $5 on Hobby and $20 on Pro that cannot be removed.
• Railway may charge part of your bill early in the cycle rather than all of it at the end.
• Downgrades take effect at the start of the next billing cycle.
• Cancelling stops every deployment in the workspace immediately, even though the plan stays active until the end of the cycle.
• An unpaid invoice stops your services until all open invoices are paid; they redeploy automatically if it is settled within 30 days.
• Deleting an account does not prorate the plan fee, and invoices for a deleted account are not refundable.
• Refunds are at Railway's sole discretion and aimed at new customers who tried the platform and want out. Resource usage is generally not refunded, and services may go offline as soon as a refund is issued.
• Data is deleted 30 days after a Free or Trial plan expires, 60 days after a Hobby cancellation and 90 days after a Pro cancellation.
• The fair use policy bans cryptocurrency mining, torrenting, reselling compute, evading usage or billing limits, proxies or anonymization services, and bots or scrapers that violate other sites' terms.

Reliability and support in 2026

Railway publishes availability targets of 99.9% on Hobby, 99.99% on Pro and 99.999% on Enterprise. We found no contractual SLA with service credits behind those numbers. The incident record over the past year:

• June 2025: after a Google Cloud outage, Railway throttled and then paused deployments for Trial and Hobby customers to protect service quality for Pro.
• February 11, 2026: a misconfigured automated abuse-enforcement system terminated legitimate deployments, disrupting around 3% of services.
• May 19-20, 2026: Google Cloud suspended Railway's production account, and at peak every Railway workload in every region was unreachable, from 22:20 UTC to about 06:14 UTC, roughly eight hours.
• July 2, 2026: about four hours of higher response times and intermittent connectivity on traffic between US regions.
• September 30, 2026: about five minutes in which new connections to Railway-hosted domains returned HTTP 404 in all regions.

Railway's own summer 2026 update admitted reliability stumbles that cost it customer trust, while reporting more than 50 million builds a month and over 12,000 new users a day. The company raised a $100 million Series B on January 22, 2026, led by TQ Ventures according to Axios, and cites 2 million users.

Support depends heavily on the plan. Trial, Free and Hobby users get community help on the Central Station forum with no guaranteed response. Pro gets direct help from Railway through Central Station, usually within 72 hours, excluding application-level support. There is no email support. Slack Connect comes with Enterprise at $2,000 a month in committed spend, and Business Class Support for accounts above $5,000 a month promises a one-hour response to P1 issues around the clock.

On compliance, Railway is SOC 2 Type II and SOC 3 certified, offers a GDPR data processing agreement, and sells HIPAA BAAs from $1,000 a month in committed spend.

The October 2026 security breach

On October 21, 2026 Railway disclosed that an unauthorized third party may have accessed encrypted environment variables and, for some of them, obtained the decrypted contents. Its preliminary report the next day put the attack window at October 20, 13:58 UTC to October 22, 03:32 UTC, through privilege escalation in build infrastructure. At most 1.85% of all workspaces, about 100,000 workspaces, had some environment variables potentially compromised, and Railway says the attacker was looking for AI credentials.

Railway also reports that running services stayed online throughout and that customer accounts were not logged into. New builds and deployments were paused during triage, and the dashboard, API, CLI and support had periods of unavailability. As a precaution Railway notified external providers about all stored keys for all users, not only the affected subset.

Railway's response so far: single-tenant builder infrastructure, rebuilt internal tooling, rotation of all bucket credentials and invalidation of user sessions. Builds were restored for every tier by October 23 at 09:34 UTC, and as of that update new signups were still paused. The report is explicitly preliminary, and the investigation was ongoing as of October 23.

What to do if you host on Railway

1. If you signed up before October 21, rotate every key stored in Railway variables: API keys, database passwords, OAuth secrets and private registry credentials. This is Railway's own recommendation.
2. Start with AI provider keys, since those were the target, and check those providers' usage dashboards for spend you do not recognize.
3. Review the logs of each service for unusual activity since October 20.
4. Seal sensitive variables so their values are hidden from the dashboard and the API.
5. If a deploy fails now that builds are back, disconnect and reconnect GitHub. Commits pushed during the pause were not deployed, so trigger a fresh deploy.
6. Set a usage alert and a hard limit so unexpected resource use cannot run up an open-ended bill.

Pros and cons

Pros

• Low entry price: $5 Hobby or $20 Pro, each fully usable as compute credit.
• Per-second billing, free builds and service sleeping keep small projects cheap.
• High per-service ceilings even on Hobby: up to 48 vCPU and 48 GB RAM.
• Managed Postgres, MySQL, Redis and MongoDB with high availability and point-in-time recovery.
• Usage alerts and hard limits on every subscription plan.
• SOC 2 Type II and SOC 3 certified.

Cons

• October 2026 breach exposed decrypted environment variables for up to about 100,000 workspaces.
• Several 2026 outages, including an eight-hour platform-wide one.
• Availability targets only, no SLA with credits below Enterprise.
• Forum-only support with a typical 72-hour response on Pro, and no email support.
• Cancelling stops deployments immediately, and refunds are discretionary.
• The Free plan is too limited for anything beyond a demo.

Frequently asked questions

How much does Railway cost per month?

At least $5 on Hobby or $20 on Pro. The fee includes the same amount of usage, so you only pay more when CPU, memory, storage and egress go past it; at that point the bill equals your usage.

Can I try Railway for free without a credit card?

Yes. The trial needs no credit card and gives a one-time $5 grant for up to 30 days, after which the account drops to the Free plan with $1 of credit per month. As of October 23, 2026, new signups were paused because of the security incident.

Can I cap my Railway bill?

Yes, with a hard usage limit of at least $10. When usage passes it Railway shuts your workloads down, so pair it with an email alert at a lower amount.

Does Railway charge for builds?

No. Build CPU, memory, base-image downloads, image exports and image storage are all free; you pay only for running services, storage and egress.

Does Railway give refunds?

Only at its discretion, and mainly to new customers who tried the platform and decided against it. Resource usage is generally not refunded, and invoices for deleted accounts are never refunded.

What happens to my data after I cancel?

Deployments stop as soon as you cancel. Data is then deleted 30 days after a Free or Trial plan expires, 60 days after a Hobby cancellation and 90 days after a Pro cancellation, so export databases and volumes first.

Is Railway safe to use after the October 2026 breach?

It is usable, but treat any secret stored there before October 21 as exposed and rotate it. Railway has moved builds to single-tenant infrastructure and invalidated sessions, but its report is preliminary, so keep sensitive credentials sealed and minimal until the final findings are out.

Does Railway have an uptime SLA?

Not on self-serve plans. Hobby, Pro and Enterprise carry availability targets of 99.9%, 99.99% and 99.999%, and support SLOs start at Enterprise; we found no service credits tied to the targets.

Railway or Render?

Pick Railway if you want per-second usage billing against a small minimum and free builds; consider Render if you prefer fixed plan pricing. Our Render review covers its current prices and limits.

Key takeaways

• Railway costs at least $5 a month on Hobby or $20 on Pro, and that fee is fully spendable as usage.
• Usage runs $20 per vCPU-month, $10 per GB-month of RAM, $0.05 per GB of egress and $0.15 per GB-month of volume storage; builds are free.
• Set an email alert and a hard limit early, and know that cancelling stops deployments immediately.
• 2026 brought an eight-hour platform-wide outage and an environment-variable breach affecting at most about 100,000 workspaces.
• If you signed up before October 21, 2026, rotate every key stored in Railway and seal sensitive variables.